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-Abstract- 

The motivation for this paper comes out of our experience with teaching natural deduction (ND) 
and with the way this formal system is implemented by the COQ proof assistant, namely by means 
of so-called tactics, which are heuristics that transform a goal formula into a sequence of subgoals 
whose provability implies that of the original formula. We aim at capturing some of these tactics 
into a system of ND for minimal logic. Our goal is twofold: formal and didactic. The former 
delivers a formal system with its underlying heuristics to build proofs, which in turn serves our 
latter purpose, that of making an ideal system for the teaching of ND at an undergraduate level 
in a computer science program. 

1 Introduction 

The importance of logic in mathematics and computer science is unquestionable. The use of 
proof-assistants, whose kernel are implemented logics, in the verification and certification of 
software and mathematical proofs is coming of age. A proof-assistant is a computer system 
that consists of a domain-specific language representing logical objects, as well as definitions 
and theorems about these objects, together with a mechanism that allows for the interactive 
construction and validation of proofs. Though proof assistants have been used to teach logic 
(e-g. 0 ), we think there is still a gap between the traditional way of teaching deductive 
systems, in particular natural deduction (ND from now onwards), using [2] for example, and 
the use of proof-assistants to solve tasks of software construction and verification, like the 
ones tackled in a programming language foundations course (c.f. [ 7 ])- This paper claims to 
be a contribution to filling this gap. 

Our main goal is to teach ND to undergraduate computer science students in the way this 
formal system is implemented by a proof-assistant, specifically COQ (http: //coq. inria.fr). 
This way, the migration from studying logic, to using it, for example in a programming 
languages foundations or a formal verification course, will be smooth, as the transition will 
be mainly syntactical. We pursuit this goal from the theoretical side, that is, we do not 
discuss here how to use COQ to teach logic. To the best of our knowledge, our approach is 
novel, for we capture Coq’s native proof search mechanism for first order logic by giving a 
formal definition of its procedural way of constructing proofs, which corresponds to what we 
may call “usual mathematical reasoning”. 
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2 Natural Deduction 

ND is, as the name says, a formalism that captures natural reasoning, as opposed to the 
formal reasoning given by Hilbert’s axiomatic systems, recall for example the derivation of 
A —► A in such a system. The flavor of ND we choose is one with localized hypotheses, called 
S-systems in [3], for this version is more akin to computer science applications. In these 
systems, inference rules are not applied over formulas, but over judgments (sequents), which 
are pairs of the form T b A where A is a formula and T is a set of formulas called the context. 
The intuitive meaning of such a sequent is that formula A is provable from the hypotheses in 
T. This way, all current hypotheses, i.e. formulae in T, are available at every derivation step. 
Therefore there is no need for a global discharging mechanism^] unlike Fitch-style ND as 
presented in mug. The specific inference rules are: 


r,A h a 


{Hyp) 


T,A\- B 
Thd-> B 


i^I) 


Thi-)B T\- A 

r h /t 


(-> E) 


T\- A r b B 
ThdAB 


(A I) 


Tb AAB 

r b a 


(a E) 


Tb AAB 
TbB 


(A E) 


r b a 

TbiVB 


(VJ) 


TbB 

TbdVB 


(VI) 


fbiVB 


r,Hbc 

r b c 


r,Bbc 


{WE) 


r b A x $ FV(T) 

r b WxA 


(VI) 


r b WxA 

T b A[x := t\ 


m 


r b A[x := t\ ^ T\-3xA T, A b C x j FV{T,C) ^ 

As usual, we have a starting rule or axiom scheme (Hyp); introduction rules (I), useful 
to prove a formula according to its logical form (i.e., its main connective or quantifier) and 
elimination rules (E), useful to obtain information from a formula. Note that neither the 
false constant _L nor the negation operator -i are present and therefore we are dealing with 
minimal logic. The reason is that we are interested in logic from an algorithmic point of view 
and classical logic departs from this view. Our notion of proof is therefore linear as opposed 
to a tree form. From a theoretical perspective, this choice is irrelevant, but the linear form is 
in accord with the way proof-assistants operate. 

► Definition 1. A proof or derivation of judgement J =def T b A from the set of judgements 
1 is a finite sequence of judgements n = {J-\ ,..., Jk) such that Jk = J and for every 
1 < i < k one of the following conditions hold: 


i 


i.e. One that involves specific previous parts of the derivation. 















F. E. Miranda-Perea , P. Selene Linares-Arevalo and A. Aliseda 


159 


h Ji is an instance of the (Hyp) rule 

™ Ji G IHI 

b For every 1 < * < k, Ji is the conclusion of an instance of some inference rule whose 
premises are Ji x ,..., Ji n with < i 

We say that F b A is provable, or simply that T b A holds, if it is provable from the 
empty set of sequents H = 0. 

► Example 2. Let r = {p — > q V r , q —> r , r —> s}, we want to show that r b p —> s holds. 


The following is a derivation of this sequenij^J 

1 

F, P b P 

(Hyp) 

2 

r, p b p-iqVr 

(Hyp) 

3 

r, p b gVr 

(-> E) 1,2 

4 

r, p, q b q 

(Hyp) 

5 

F, P, q b q -S> r 

(Hyp) 

6 

F, P, q b r 

(-> E) 4,5 

7 

r, p, r b r 

(Hyp) 

8 

r, pb r 

(VE) 3,6,7 

9 

r, p b r —> s 

(Hyp) 

10 

r, p b s 

(-> E) 8,9 

11 

r b p — > s 

(->• i) io 


At this point, following definitions and a few examples, most books demand from the 
students the task of solving more exercises. There is no discussion as to how to master 
or even perform a derivation process! The very question of how to prove it is unanswered 
and left to the creativeness and luck of the student. There is however a marginal, though 
remarkable exception in philosophy, which goes back to the Greeks in their study of analysis 
and synthesis', the former depicts the backward process of working a mathematical proof, the 
latter concerned with the forward derivation in a proof. More recently, a modern pioneering 
work in the study of heuristics is [5], in which heuristic strategies and guidance are given 
to solve mathematical problems. Some other proposals which provide guidance to proof 
construction are found in a brief discussion in [Sj, and a much better one in [5j. 

As the above proof suggests, performing the derivation process is not easy, perhaps due 
to the rigidity of definition [l] Just note that more than half of the steps are instances of 
the (Hyp) rule, which is mainly needed to be able to apply (—>■ E). These steps do not at 
all reflect a natural way of reasoning and thus make S-systems inconvenient, as opposed to 
Fitch-style systems. 

The question of how to obtain such proof is quite difficult to answer directly, but a 
clever student can justify it by appealing to the following mathematical reasoning. The 
formula we have to proof is an implication, therefore we assume the antecedent p and prove 
the consequent s, which corresponds to steps 11 and 10 in the previous proof. Next we 
observe that r —f s is part of the premises, so it suffices to prove T, p b r (step 8). Here 
the application of (—> E) is implicit, but the proof must be explicit and forces us to add 
step 9. To prove the sequent at step 8, we might try to reason as in steps 10 and 11, using 


2 


The last column is not part of the formal derivation, but consists of justifications for every step, according 
to definition [T] 
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the premise q —> r, which would lead us to seek a proof of T, p h q. But after some failed 
attempts we realize that q V r is derivable from the current premises (steps 1 to 3) and 
that by a case analysis on this formula we can easily obtain r as follows. If q happens 
then the premise q —> r yields r by {—> E) (steps 4 to 6), and if r is the case, we are done 
(step 7). Following this reasoning, the student is faced with the problem of constructing 
the formal proof, which requires that we start with instances of the {Hyp) rule and go 
forward to obtain what we need. By comparison with the reasoning used to obtain the 
steps of the proof, this is, quite unnatural. Intuitively, all ND proofs can be constructed by 
such mathematical reasoning, but it is not clear in general, how to transform this reasoning 
into a formal derivation. An attempt, that combines both, reasoning forward from the 
hypotheses and backward from the conclusion, is the intercalation calculus, implemented by 
the AproS system (http://www.phil.cmu.edu/projects/apros/). Our purpose here is 
not to elaborate further on this, but to put forward a formal notion of backwards derivation, 
which we call derivation by tactics (to be found in definition [5]) , one that produces proofs 
equivalent to the usual ones (equivalence proof will be stated as theorem [9]) and that captures 
the procedural reasoning “understood” by proof assistants. 

Let us start by stating some heuristics. 

2.1 Heuristics 

The following two strategies can be used systematically to build a proof of a given judgement: 

h Backward reasoning: To show that T b A is derivable start by analyzing the judgement 
and work backwards towards the axioms. To generate a proof, mantain a queue of current 
goals (sequents whose derivations are to be searched for), which initially includes only 
the original judgement. Remove a judgment from this queue, and consider a rule whose 
conclusion is that judgement, adding the premises of such a rule to the queue, as subgoals. 
This process must be repeated, with the same starting queue, for each possible rule. The 
process terminates when the queue is empty, meaning all goals have been achieved. 
h Forward reasoning: To show that T b A is derivable, start with axioms and work forwards 
towards the desired judgement. To generate a proof, extend a sequence S of already 
derived judgements, which is initially empty, by adding to it the conclusion of any rule 
whose premises are in S. This process generates several sequences and, assuming that all 
rules are considered to add new sequents, the strategy will eventually find a derivation of 
the original judgement. 

We are interesed in developing a goal-directed system based on backward reasoning that 
allows for the automation of proof construction, using a mathematical reasoning, as sketched 
above. To do so we restate our strategy more formally, following the proof strategies discussed 
in 0. 

• Our initial goal is the judgement we want to prove, say Q =def T b A. 

• By analyzing T and A, we substitute the initial goal Q by simpler subgoals, say Gi, ■ ■ ■ ,Gk, 
whose provability implies the provability of Q . After the substitution Gi becomes the 
current goal. This process can be done using one of the following heuristic rules: 

• Conclusion Analysis (CA): The analysis of A leads us to identify its logical form (i.e. 
its main operator, a connective or a quantifier) and substitute the original goal by the 
premises of the corresponding introduction rule. Of course, if A is atomic this kind of 
analysis is not useful. 
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• Premise Analysis (PA): We focus on an specific formula B in T which, according to 
our previous experience and formerly derived judgements, can help us to prove the 
original formula A. This analysis generates new subgoals either by modifying the context 
according to the logical form of B or by modifying the conclusion. 

• Lemma Assertion (LA): Sometimes the current goal is not directly provable by CA and 
PA, but follows from an intermediate judgement, like a lemma, which is derivable from 
the current hypotheses. 

• A clever combination of the three previous items eventually yields a current goal which is 
evident (i.e. is an axiom, a hypothesis or an already proved judgement) and therefore 
discarded from the current sequence of subgoals. 

• The process ends succesfully when there are no more subgoals to prove. 

A justification for the adequacy of our heuristic rules, will be given in next section. 
According to the logical form of a conclusion or premise, the heuristics (CA, PA or LA) 
generate different subgoals. For example, if the current goal is T h B A C, CA yields two 
subgoals, namely n-B and rhC, being r b B the new current goal. Each of these ways of 
generating subgoals is what we call a tactic. 

Even if it may seem a bit redundant, we would like to rework example [2] in order to make 
explicit the application of our heuristic rules: the initial goal is (the judgement in) step 11, 
and applying CA to this sequent yields step 10; from this PA on the premise r —> s leads 
to step 8, thus avoiding step 9. To prove step 8, we try PA on q —>• r, which yields T,ph q. 
This sequent is not derivable by our own means, but fortunately we realize that, according to 
the information on T, the formula r is a consequence of q V r, so we can use LA, the lemma 
being gVr. This is provable by means of PA on the premise p->gVr, this avoids step 2 
and yields step 1 as trivial goal, hence the lemma is proved. As we now know gVr, we can 
substitute the goal in step 8 by T,p, q V r h r, and then use PA on gVr, which generates two 
subgoals, namely steps 6 and 7, the latter is a trivial goal whereas the former is consequence 
of step 4 by means of PA on premise q r, and thus step 5 is avoided. At this moment, 
step 4 is the only remaining subgoal, which is trivial and therefore the proof is finished. 

Let us present this train of reasoning in a more systematic way, one that gives guidance to 
the student about how to prove it. The following sequence is not a derivation in the sense of 
definition [Tj but a sequence of backward reasonings where step i + 1 is obtained by applying 
our heuristic rules CA,PA or LA to the first sequent in step i. 

1 rhp->s Original Goal 

2 T, p b s CA. 

3 r, p b r PA(r —> s ). 

The current goal is T, p b r. As r is atomic, CA is useless; we try PA and find that 
q —> r seems a natural candidate to continue the process, but this would lead us to a dead 
end when trying to prove sequent T, p h q. Instead, LA comes in action, and generates two 
subgoals (separated by a semicolon): 

4 r, phgVr ; r, p, gVr hr LA(g V r). 

The current goal is now the lemma T, p h q V r and PA yields 

5 r, p\~ p ; r, p, gVr hr PA(p —yqVr). 
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The new current goal is T, p b p, which is trivial and can be discarded 
6 T, p, q V r b r trivial 

The case analysis is now a consequence of PA(q V r). The specific tactic generates two 
subgoals, each assuming one of q and r. In the first case r is proved by means of PA(g —> r), 
and in the second the proof is trivial, for r is itself a premise. This way, all subgoals are 
proved and the original goal succeeds. 


7 

r, 

p, 

9 

b r ; 

r, p, r b r 

PA(g V r). 

8 

r, 

p, 

9 

I- 9 ; 

r, p, r b r 

PA(g —> r ) 

9 

10 

r, 

p, 

r 

b r 


trivial. 

trivial. 


The last step indicates that there are no more subgoals left and therefore the proof is finished. 

The aim of this work is to capture the above reasoning by means of a formal system. It is 
clear that this kind of derivation is sequential, meaning that each step depends solely on the 
previous one. Therefore we can view this process as a transition system. 

2.2 A Tactical Approach to ND: Formalization 

We are now in a position to formalize the previously discussed heuristic processes by means 
of a transition system that manipulates sequences of goals (judgements). 

► Definition 3 . A transition system is a triple of the form T = >) where S 0 is 

a set of states or configurations; F C S is the set of final or terminal states; D> C S x S is 
a binary relation on S, called the transition relation, such that for every F £ F and every 
S £ S, F \t> S. That is, there are no transitions from final states. 

For the sake of clarity, let us say that a goal Q is a judgement, we denote a finite sequence 
of goals as S =def Q\\ ■ ■ ■; Qk- The set of such sequences is GSeq , in particular we have 
□ £ SeqG , where □ represents the empty goal sequence. 

The transition system below captures the backward reasoning strategy by formalizing 
the process of substituting a goal with its corresponding subgoals according to the heuristic 
rules CA,PA or LA. 

► Definition 4. The transition system of tactics is defined as T = (GSeq, {□}, >). That is, 
a state is a sequence of goals; the only terminal state is the empty sequence of goals □ ; and 
the transition relation [> between states is given by the following rules, called tactics: 

h Conclusion Analysis (CA): 

_ intro: TbA —> B',S [> r, Ah B; S 

m split: rh AA5;5 [> r b A; T h .B; >S 

_ left: rh AVB;5 [> r h A;5 

_ right: rhAvB;5 [> T\~B,S 

_ intro: T b \/xA\S > T b A;5 where w.l.o.g., x ^ .FV'(r) 

_ exists: T b BxA; S t> T b A[x := t\; S 
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h Premise Analysis (PA): 

_ apply: [> r, A — > B \- A\S 

_ destruct: r, A A B b C; S [> r,A, B\~C;S 

_ destruct: T,A\/B\-C;S > r, A b C; T, B b C; S 

_ destruct: r, 3:rA b C; 5 D> r, A h C; 5 where w.l.o.g. x ^ FV{T ) 
h Lemma Assertion (LA): 

_ assert: rbC;iS > r h A; T, A h C; 5 

_ cut: rhC;5 > T b A -> C; T b A; S 
_ Discarding tactics: 

_ apply: r, VxA b A[x := t]; <S > 5 

_ trivial: r,AbA;5 D> 5. 

These tactics are classified according to the heuristic rules of the backward reasoning 
strategy: the first group is generated by each particular case of CA, according to the logical 
form of the conclusion; the second group comes from PA, in agreement with the logical form 
of the focused premise; the process of lemma assertion is given by the third group. Observe 
that both LA tactics are the same from a logical point of view, but, as we are dealing with 
goal sequences, they are quite different from an operational point of view. Finally, discarding 
tactics, that is, those whose application decreases the number of subgoals, are provided by 
the fourth group. 

We now give a brief justification of the four tactic groups: discarding tactics correspond 
to proving axioms, that is, sequents given by the {Hyp) rule or sequents of the form 
r,Va:A b A[x := t\ corresponding to universal instantiation. LA tactics are justified by 
the so-called substitution property of the ND system: if T, A b C and T b A then F b C 
(the formula A is the lemma). LA tactics rules require the generation of a new formula 
(A), a difficult, if not an impossible task for theorem provers to implement the transition 
system. The operational mechanism of CA tactics is supported by the inversion principle]^] 
of the introduction rules. Finally, PA tactics are justified by the inversioiQ of the following 
admissible]^] inference rules which generate subgoals either by simplifying a premise or, in the 
case of implication, by modifying the conclusion: 

T,A^BbA 

r,A^5b5 


r,A,Bbc r,Abc r,Bbc r,Ab c x i fv{t,c) 
T,AAB\-C r,Avfi b C T,3xA b C 

It is now clear that the backward reasoning strategy is captured by the transition system, 
therefore a derivation by tactics is simply a sequence of transitions ending on the final state 
□ . 


3 That is, the derivability of the conclusion implies the derivability of the premises. This property becomes 
a theorem when the context T is empty. 

4 Again, this is a theorem for T = 0. 

5 That these inference rules are admissible is a direct consequence of the elimination rules (more details 
in the extended version of this paper). 
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► Definition 5. Let J =def r b A be a judgement. A derivation of J by tactics is a sequence 
of states iS| ..... such that Si = J , for every 1 < i < k, Si [> Sj+i and Sk = If such a 
derivation exists, we write J t> + □. 

We now show a derivation by tactics of our running example. 

► Example 6. Let r = {p -A q V r, q r, r —> s}. The following sequence of transitions 
shows that rhp->sl> + D. In the right column of step i + 1 we annotate the name of the 
tactic that allows for the transition from step i to step i + 1. 


1 T b p — > s 

2 T.phs 

3 T.phr 

4 T, pbgVr ; T, p, gVrhr 

5 T, p b p ; T, p, gVrhr 

6 T, p, (jVrhr 

7 T, p, q b r ; r, p, r b r 

8 T, p, q\~ q ; T, p, rhr 

9 T, p, r h r 
10 □ 


intro 

apply r —> s 
assert q V r 
apply p->gVr 
trivial 

destruct gVr 
apply q r 
trivial 
trivial 


Let us now present a more elaborated example. 

► Example 7. Let T = {(a; Vp) Ag-i 1, mVg -i sAt, (sAt) Ai -A s, prig}. The 
following is a derivation by tactics ofThmAp —> x. 


1 

T b m A p —> x 


2 

T, mApbi 

intro 

3 

T, m A p b (s A t) A l 

apply (s A £) A l -> x 

4 

T, ro,pb(sAt)Al 

destruct to A p 

5 

T, ro,pb s Af ; 



T, m,pb l 

split 

6 

T, m,p b to V q ; 



T, m,p b l 

apply roVg-> s Af 

7 

T, m,pbm ; 



T, ?n,p b l 

left 

8 

T, m,p b l ; 

trivial 

9 

T, ro,pb(iVp)Ag 

apply (iVp) Ag->l 

10 

T, m,pbiVp ; 



T, ro,pbg 

split 

11 

T, m,pbp ; 



T, ro,pbg 

right 

12 

T, m,p\- q 

trivial 

13 

T, m,p b p 

apply p ->• g 

14 

□ 

trivial 


In order to show how our approach works in first order (minimal) logic, here is an example. 
► Example 8. We give a derivation by tactics of the sequent 
b \/v(Pv —> Qv) —> \/x(3y(Py A Rxy ) —> 3 z(Qz A Rxz )). 
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1 

2 

3 

4 

5 

6 

7 

8 

9 


10 

11 

12 

13 


b \/v(Pv —► Qv) -¥ Va;(3 y(Py A Rxy) —>• 3 z(Qz A Rxz )) 
\/v(Pv —> Qr?) b \/x(3y(Py A Axy) —> 3z(Qz A Rxz)) 
\/v(Pv —> Qv) b 3y(Py A i?a;y) —> 3t(Qt A Rxz) 

\/v(Pv —> Qz>), 3 y(Py A -Rzy) b 3z(Qz A Rxz) 

Vv(Pv —> Qu), Py A Pry b 3 z(Qz A Rxz) 

\/v(Pv —> Qw), Py, Pccy b 3t(Q,s A Pa;z) 

\/v(Pv —> Qw), Py, Pxy b Qy A P:ry 
Vv(Pv -» Qv), Py, Rxy b Qy ; 

\/v(Pv —> Qv), Py, Rxy b Rxy 
\/v(Pv —>• Qu), Py, Pccy b Py ->■ Qy ; 

Vv(Pv ->• Qw), Py, Pzy, Py ^ Qy ^ Qy ; 

\/v(Pv —> Qv), Py, Rxy b Rxy 
V v(Pv -> Qv), Py, Rxy, Py ->• Qy b Qy ; 

\/v(Pv —> Qu), Py, Rxy b Pxy 

Wv{Pv -> Qu), Py, Rxy, Py ->• Qy b Py ; 

\/v(Pv —> Qr;), Py, Rxy b Pccy 
\/v(Pv —> Qv), Py, Rxy b Pccy 
□ 


intro 

intro 

intro 

destruct 

destruct 

exists y 


3y(Py A Rxy) 
Py A Pa;y 


split 


assert Py —> Qy 

apply \/v(Pv —> Qu) 

apply Py -> Qy 

trivial 

trivial 


We end by stating the theorem that guarantees that the usual concept of derivation given 
in definition [l] coincides with our proposed notion of derivation by tactics given in definition 
[5] The proof of this theorem may be found in the extended version of this paper. 

► Theorem 9 (Equivalence of b and > + ). For any sequent J, J > + □ if and only if J is 
provable. 


3 Final Remarks 

Due to lack of space we were not able to discuss COQ properly. Nevertheless, we want to 
mention that its underlying first order logic mechanisms can be understood as our transition 
system T. Actually, the name we give to each tactic in definition [4] is the name of its 
corresponding COQ command (c.f. my For example, a COQ proof of our running example is 
given in the following script: 


Hypotheses (p q 

r 

s : 

Prop ) 

(HI : 

P 

-> 

q \/ r) 

( H2 : 

q 

-> 

r) 

( H3 : 

r 

-> 

s) . 

Theorem Examplel 


P " 

> s . 

Proof . 




intro . 




apply H3. 




assert (q \/ r) 

as 

H4 



apply HI. 
trivial . 


de struct H4 . 
apply H2 . 
trivial . 
trivial . 

Qed . 
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The reader may realize that once the tactical approach is understood, this computer- 
assisted proof is quite clear. Therefore, our goal for a smooth migration from teaching to 
using logic has been accomplished. Indeed, our backward reasoning strategy (as discussed in 


2.11 has been presented to students in a computational logic course, and had a very good 


reception. At the moment, we will use this material in two of our courses (Computational 
Logic and Automated Reasoning), where we will test the tactical approach as a way to 
introduce COQ. The results of this experience will be reported later. The main difference 
between our approach and that of COQ is that in the latter hypotheses are labeled, in order 
to make it possible to have further reference to them. If we use these labels as variables 
of a A-calculus, as is done by COQ, we can encode the application of every inference rule 
with a A-term. From this encoding, the mechanism of derivation by tactics yields a A-term 
which encodes such a proof, and we can decode this proof into a usual derivation. This is the 
well-known Curry-Howard correspondence. Part of our future work is to explore the benefits 
of this powerful result for teaching logic. With respect to classical logic, we may extend our 
approach by allowing the use of lemmas of the form A V —>A (without requiring its proof), or 
by adding, for instance, the tactic T,-i A h B ; 5 > T h A ; S , which corresponds to proving 
B by contradicting the hypothesis -<A. However, the inversion principles that support our 
proposal are invalid in this case and therefore we cannot guarantee the feasibility of the 
tactical approach. A further line of research is to extend our approach to other logics. We 
are particularly interested in modal logic. In this respect, the second author of this paper 
(in 51 ) has verified in COQ the definition and properties of the ND system for modal logic 
developed in [6], something which allows for a straightforward definition and implementation 
of our tactical approach for the case of modal logic. 
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